46e1d65e779b191aa7a0d1d7a53a3a48_JaffaCakes118 | Triage

Sharing

General

Target

46e1d65e779b191aa7a0d1d7a53a3a48_JaffaCakes118
Size

292KB
MD5

46e1d65e779b191aa7a0d1d7a53a3a48
SHA1

cf3086be9bc35fe7ee0bd4d5b8a44342989e7d3f
SHA256

d5196d72704dfb7d0ced8f30318502a77f4f558bab6845dcea0e64e6342c67bc
SHA512

ae123169f9f2d0f0d39f750c4a5280801ee73e1e4c10aab775fc7dd2434dbd3f1a689812621b5d43091eaa70ff3e3a9b9ac9a216c2bf3b813070f106cb86b076
SSDEEP

6144:bOKduSp/kmVBZ4NrNFo0ONEQAmgGU5lK2Qmn1ByyicqXLV:bHdN/hIlONEQAxGYc2vpcV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46e1d65e779b191aa7a0d1d7a53a3a48_JaffaCakes118

Files

46e1d65e779b191aa7a0d1d7a53a3a48_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c30e69e0e1b4575278dd3fa467b7021f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strncmp
_strnicmp

user32

MessageBoxA
wsprintfA

kernel32

ResumeThread
HeapAlloc
IsBadReadPtr
HeapFree
GetModuleHandleA
GetModuleFileNameA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ExitProcess
WaitForSingleObject
CloseHandle
GetEnvironmentVariableA
TerminateProcess
lstrcpyn
GetProcessHeap

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 858B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE